Leases and portable proofs

Integration steps

1. A lease is bounded by one evaluation, candidate/context commitments, action ceiling, expiry, checkpoint and authority epoch. ASK with missing facts has no approval shortcut.
2. Only an explicit authority-confirmation ASK can become pending authority. Changing a candidate or context requires a fresh decision or the defined checkpoint/resume flow.
3. Proof issuance refuses legacy leases without modern commitments. Minimal disclosure is the default; the owner controls optional disclosure.
4. Verify signature, issuer trust, audience, expiry, status and commitments independently. A valid signature from an untrusted issuer remains untrusted.
5. Revoked epochs and INVALID status entries never revive. Verification does not authorize payment, booking, messaging, account or legal action.

Issuer metadata: /.well-known/tastepolicy-issuer
Public keys: /.well-known/jwks.json
Verifier: POST /api/attest/verify
Human inspection: /verify